I have a network so configured: a router and a RPI that acts as wifi access point, dhcp and dns servers, firewall and gateway. The RPI is also connected with a OpenVpn client to a payed VPN service (NordVPN) so all the WiFi clients use the VPN connection.

I'm trying to create a private VPN so I can connect to the RPI also from outside. I run a VPN server on the RPI for this use. NordVPN does not provide port forwarding so I cannot connect to the RPI through the NordVPN IP address and I'm tryint to reach the RPI from the ISP public IP. I configured the port forwarding from the router to the RPI local IP address.

I'm able to connect with the private VPN to the RPI when the NordVPN connection is off but I cannot connect when the NordVPN connection is running.

I read the problem is the routing so I configured it and the maximum result reached is that I can do SSH from outside to the RPI when the NordVPN connection is runnging but I'm not able to connect with my OpenVPN client (with running NordVPN). The problem is that client and server do not complete the handshake. The server receive the first packet (I thing the firewall could be ok) but it is not able to send the reply (or it send through the wrong route). But it seems this problem there is not with SSH connection because it works from out (and I guess the server reply to the client handshake).

Other info:

  • is the local client's network (rpi's wifi)
  • is the local router's network
  • is the router
  • is the RPI eht0
  • is the NordVPN tun0 network
  • the payed VPN runs on standard OpenVPN port but the private VPN runs on different port

First, following here, I tried to forward from router to with these routes on RPI.

ip rule add fwmark 65 table novpn
ip route add default via dev eth0 table novpn
iptables -t mangle -A OUTPUT -p udp --sport 1234567 -j MARK --set-mark 65

In this case I was able to connect via private VPN only without NordVPN running.

Second, following here, I created a virtual eth0 interface ( I forwarded from router to this new address and I configured the routes like this:

ip addr add dev eth0:0
ip rule add from table 1234
ip route add default via dev eth0:0 table 1234

So I can connect via SSH from outside also when NordVPN connections is active but when I launch the private VPN client it is not able to complete handshake with these errors:

XXX.XXX.XXX.XXX:53347 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:53347, sid=5138c564 319ce197
Dec 08 23:02:55 rpi ovpn-server[19950]: XXX.XXX.XXX.XXX:53347 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Dec 08 23:02:55 rpi ovpn-server[19950]: XXX.XXX.XXX.XXX:53347 TLS Error: TLS handshake failed

I am on this problem since 2 weeks and I have definetly no other idea. Maybe someone could help me?

Thanks in advance.

PS: I do not write my iptables rules because they are a lot.

UPDATE: this is my server.conf

dev tun
proto udp
port PORT
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/XXX.crt
key /etc/openvpn/easy-rsa/pki/private/XXX.key
dh none
topology subnet
# Set your primary domain name server address for clients
push "dhcp-option DNS"
push "dhcp-option DNS"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using and
# rather than This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device. 
# Generated for use by PiVPN.io

and this is the private client conf

dev tun
proto udp
remote ISP_IP PORT
resolv-retry infinite
remote-cert-tls server
tls-version-min 1.2
verify-x509-name XXX name
cipher AES-256-CBC
auth SHA256
verb 3

These are my routes:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface       UG    0      0        0 tun0         UG    0      0        0 eth0   U     0      0        0 tun0   U     0      0        0 tun1       UG    0      0        0 tun0   U     0      0        0 eth0   U     0      0        0 wlan0
NORDVPN_GW UGH   0      0        0 eth0


The network topology is:

WIFI LAN CLIENTS (192.168.4.X) -> RPI (eth0, wlan0, tun0 NordVpn client, tun1 OpenVpn server) -> ROUTER ( -> INTERNET

What I'd like to do:


  • i aint understanding what your trying. a vpn tunnel may set all to forward the traffic through its tunnel. it might be a trick to tunnel through port 443
    – djdomi
    Dec 9, 2019 at 14:44
  • Many thanks for the reply. I'd like to send all the traffic generated from the LAN to the NordVPN connection (and now it works) but I need also to connect to the RPI from outside (via private VPN and it does not work)
    – drugo
    Dec 9, 2019 at 17:07
  • lan > vpn (nord) > Internet is your currently way? and you want Internet > privatevpn (unknown daemon) > lan or do i understand wrongly?
    – djdomi
    Dec 9, 2019 at 19:08
  • Yes, you understand correctly and the private vpn daemon is a OpenVPN server service.
    – drugo
    Dec 9, 2019 at 21:50
  • for me it is still unclear what your trying. one part is outgoing and the other one incoming. please show the openvpn config without the Certificate (client/server)
    – djdomi
    Dec 10, 2019 at 21:31

1 Answer 1


I solved.

The problem, in this case, is this line missing in OpenVPN server configuration.


So the right routing for me is:

ip rule add from table novpn
ip route add default via dev eth0 table novpn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.